{"ip":"89.147.147.105","total_events":11178,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"11,178 events across 1 port(s)","confidence":"high","network_type":null,"why":["11,178 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 6036s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"933,101,976 bytes sent, longest session 6036s","bytes_sent":933101976,"session_seconds":6036,"persistent":true}},"first_seen":"2026-08-31T14:25:27","last_seen":"2026-08-31T16:06:03","events_24h":0,"events_7d":11178,"geo":{"country_code":"OM","country_name":"Oman","region":"Muscat","city":"Muscat","lat":23.578,"lon":58.4021,"asn":204170,"org":"Awaser Oman LLC"},"source_domain":"static-host-89-147-147-105.awasr.om","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":53,"proto":"tcp","label":"DNS","count":11178}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-31","count":11178}],"recent_events":[{"timestamp":"2026-08-31T16:06:03","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Qr�Ֆ","payload_hex":"5172d6d596","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11178,"duration_ms":6036246,"bytes_in":157277,"bytes_out":156474},{"timestamp":"2026-08-31T16:06:02","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"<\u0000xV�\u0016��^�","payload_hex":"3c007856b516dfe55ec4","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11177,"duration_ms":6035957,"bytes_in":157272,"bytes_out":156460},{"timestamp":"2026-08-31T16:06:02","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"%2�\f","payload_hex":"2532c40c","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11176,"duration_ms":6035716,"bytes_in":157262,"bytes_out":156446},{"timestamp":"2026-08-31T16:06:02","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{�8�","payload_hex":"7bfa38dc","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11175,"duration_ms":6035571,"bytes_in":157258,"bytes_out":156432},{"timestamp":"2026-08-31T16:06:02","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�D�t۸�)��","payload_hex":"ee44a974dbb88229b6b5","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11174,"duration_ms":6035403,"bytes_in":157254,"bytes_out":156418},{"timestamp":"2026-08-31T16:06:02","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003��Q�","payload_hex":"03f8d651c7","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11173,"duration_ms":6035302,"bytes_in":157244,"bytes_out":156404},{"timestamp":"2026-08-31T16:06:02","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��}}�","payload_hex":"d1c47d7df0","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11172,"duration_ms":6035196,"bytes_in":157239,"bytes_out":156390},{"timestamp":"2026-08-31T16:06:01","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�>K�","payload_hex":"c63e4bc2","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11171,"duration_ms":6034456,"bytes_in":157234,"bytes_out":156376},{"timestamp":"2026-08-31T16:06:01","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001gq]","payload_hex":"a30167715d","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11170,"duration_ms":6034251,"bytes_in":157230,"bytes_out":156362},{"timestamp":"2026-08-31T16:06:00","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�Ey�\u001c \u0001�\u0003","payload_hex":"e74579d11c2001af03","method":"","user_agent":"","ja3":"","session":"bda10518-f33e-43ed-b9c4-54dbbde166ed","seq":11169,"duration_ms":6033877,"bytes_in":157225,"bytes_out":156348}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-04T20:57:08.295340+00:00"}